Sub-processors
Provider matrix, regions, and international transfer safeguards.
This appendix lists the processors used to operate AIFACECRAFT. It is versioned for auditability and is updated together with our Privacy Policy whenever a processor, region, or transfer safeguard changes.
Changes to this appendix. 18 October 2026 (version 2026-10-v8): Upstash's data scope now names the short-lived sign-in record used during Google or Apple sign-in, which also carries the campaign tags of the link you arrived from for up to 15 minutes; Vercel's role and data scope now include cookieless page statistics. No new provider. 12 October 2026: Google Ads (Google LLC) added, for measuring our own ad campaigns with marketing consent only and ad personalisation switched off; Google Analytics' data scope now notes that purchases are also reported from our server. 4 October 2026: BytePlus's processing locations updated to those stated in its documentation (Malaysia, Indonesia and/or the EU/EEA; the contracting entity remains in Singapore); OpenAI's contracting entity name corrected to OpenAI OpCo, LLC. The transfer safeguards are unchanged. 3 October 2026: Vercel's application servers for AIFACECRAFT moved from the United States (US East) to Japan (Tokyo), next to our database. Requests still enter through the Vercel edge location nearest to you; the contracting entity (Vercel Inc.) and the transfer safeguard are unchanged; the safeguard is now described as Vercel's data processing addendum states it. 26 September 2026: Higgsfield (Higgsfield Inc.) listed as active, as a backup provider for video generation only. 24 September 2026: BytePlus (ByteDance group) listed as active; Google's Gemini API and Google Analytics added; the roles, data scopes, regions and transfer safeguards of the listed providers brought up to date. 19 September 2026: OpenAI added.
Current provider matrix
| Provider | Role | Data scope | Region | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Authentication, database, and storage infrastructure | Account credentials, profile data, platform records | Japan (Tokyo, ap-northeast-1) | Supabase DPA: standard contractual clauses with the UK International Data Transfer Addendum (contracting entity Supabase Pte. Ltd., Singapore). Japan's UK and EU adequacy decisions describe the storage location, and are not relied on as the transfer mechanism |
| Stripe | Payment processing and subscription management; for purchases sold through Link (Sold through Link, LLC, a Stripe affiliate), merchant of record | Billing identifiers, transaction records, subscription state | EU / US (processor-managed infrastructure) | Stripe DPA with approved transfer mechanisms. For purchases sold through Link, Stripe and Link also act as independent controllers of the checkout and order data under their own privacy policy |
| Google Cloud (Vertex AI) | AI image and video generation | Prompt text, and the photographs, reference images and video frames submitted for a generation | United States, and other locations selected by Google | Google Cloud DPA: standard contractual clauses with the UK Addendum (contracting entity Google Cloud EMEA Ltd.) |
| Google (Gemini API) | AI image and video generation | Prompt text, and the images, video frames and reference clips submitted for a generation | Not region-bound: Google states that this data may be stored transiently or cached in any country where Google or its agents maintain facilities | Google's Data Processing Addendum for Products Where Google is a Data Processor, which applies to paid Gemini API use |
| fal.ai (Features and Labels Inc.) | AI image and video generation | Prompt text, and the images, video frames, clips or masks submitted for a generation | United States and other countries where fal or its service providers operate | fal.ai DPA: standard contractual clauses with the UK Addendum (contracting entity Features and Labels Inc., United States) |
| Cloudflare | Bot detection (Turnstile) and edge security | Challenge tokens and request metadata; sets the cf_clearance and __cf_bm cookies | Global edge network | Cloudflare DPA: standard contractual clauses with the UK Addendum (contracting entity Cloudflare, Inc., United States) |
| Vercel | Application hosting, edge network, request routing, and cookieless page statistics | Request metadata and traffic necessary to serve the application; and, unless you switch off analytics in Cookie settings, page views for usage statistics (the page address without parameters, the referring website, country, browser and device type), counted without cookies or storage on your device | Japan (Tokyo, hnd1) for application servers; requests and routing at the Vercel edge location nearest to you; Vercel operates its platform mainly from the United States | Vercel DPA: standard contractual clauses with the UK International Data Transfer Addendum (contracting entity Vercel Inc., United States). Vercel Inc. is also certified under the UK Extension to the EU–US Data Privacy Framework. Application servers run in Japan; the safeguards cover Vercel Inc.'s access to them |
| Upstash | Rate limiting, abuse prevention and analytics de-duplication | Short-lived rate-limit counters; the catalogue items opened each day, for the daily catalogue limit; for up to 15 minutes during Google or Apple sign-in, a sign-in record (that you ticked the terms box, and the campaign tags of the link you arrived from); and, only if you accept analytics cookies, markers showing that an analytics event has already been reported, so it is not counted twice (kept for 13 months). All are keyed by one-way hashes of the client IP address, account ID or email address, or by a random sign-in identifier, never the raw value, and contain no message content | EU (Belgium, GCP europe-west1) | Upstash DPA: standard contractual clauses with the UK Addendum (contracting entity Upstash, Inc., United States). Data rests in the EEA; the safeguards cover the operator's access to it |
| Google Workspace (Gmail SMTP relay) | Transactional and notification email delivery | Recipient address and message content of service, compliance, and waitlist notifications | EU / US (Google-managed infrastructure) | Google Cloud Data Processing Addendum + SCC / UK Addendum |
| Sentry | Application reliability and error monitoring | Diagnostic telemetry and error traces (no user content); approximate city-level location derived from the connection IP at ingest | EU (Germany) | Sentry DPA with EU data residency; SCC / UK Addendum for any onward support access |
| Google Analytics (Google LLC) | Website analytics, only after you accept analytics cookies | Analytics cookie identifier, IP address and browser information, the page path without its query, for the first page of a visit the referring website's domain and campaign labels (never the full referring address), and three events (sign-up, first generation, purchase); purchases are also reported from our server after payment | United States | UK Extension to the EU–US Data Privacy Framework (Google LLC is certified) |
| Google Ads (Google LLC) | Measurement of our own ad campaigns, only after you accept marketing cookies; ad personalisation is switched off | Ad click identifier from the ad link (gclid, gbraid or wbraid) and Google advertising cookies, the analytics identifier, and for conversions the action type (sign-up or purchase), purchase amount, currency and a hashed order reference. No name, email address, prompts, images or payment details | United States | UK Extension to the EU–US Data Privacy Framework (Google LLC is certified) |
| OpenAI | AI image generation | Prompt text and the images submitted for a generation | United States | OpenAI Data Processing Addendum, part of the OpenAI Services Agreement: standard contractual clauses with the UK International Data Transfer Addendum (contracting entity OpenAI OpCo, LLC, United States) |
| BytePlus (ByteDance group) — ModelArk | AI video generation, including an automated check on reference images and storage of the images and clips you register for video | Prompt text, and the images, video frames, clips and audio submitted for a video, including those you register for later use | Malaysia, Indonesia and/or the EU/EEA, as stated in BytePlus's documentation; contracting entity in Singapore | BytePlus Data Processing Addendum, part of the BytePlus Customer Agreement: EU standard contractual clauses with the UK International Data Transfer Addendum (contracting entity BytePlus Pte. Ltd., Singapore) |
| Higgsfield (Higgsfield Inc.) | Backup AI video generation, used only when our primary video provider is at capacity or cannot accept a request | Prompt text, the images, video frames, clips or audio submitted for that video, and the generated video | United States, and other countries where Higgsfield or its service providers operate | Higgsfield's standard terms of service. Higgsfield receives this content as an independent controller and relies on the transfer safeguards described in its own privacy policy; no separate data processing agreement is in place |
Change control
We update this appendix when processors, regions, or transfer safeguards materially change. Material updates are reflected in the Privacy Policy update cycle.
For vendor-specific DPA requests, contact legal@aifacecraft.com.